CVE-2026-38755 Memory corruption in BusyBox

Low 2.9 Published 15 Jul 2026 Updated 20 Jul 2026

Attackers can cause a Denial of Service in BusyBox by supplying crafted input to the shell, impacting systems relying on this embedded utility.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-38755?

CVE-2026-38755 is a low-severity memory corruption vulnerability in BusyBox, published on 15 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Weakness: CWE-122, CWE-674

Which versions are affected by CVE-2026-38755?

It affects 1 product.

Products include Busybox Busybox.

How do I fix CVE-2026-38755?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-38755 being exploited?

There is no known exploitation of CVE-2026-38755 in the wild and no public exploit code.

Sources

Also known as AZL-92487, BELL-CVE-2026-38755, DEBIAN-CVE-2026-38755, ECHO-d46b-865d-7398, GHSA-jcqv-rj94-jmx3, MINI-xff6-pcp2-px3x and 1 more.